[Snyk] Security upgrade next from 15.3.3 to 15.3.8

[Dargon789]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• packages/create-onchain/templates/next/package.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Deserialization of Untrusted Data SNYK-JS-NEXT-14400636	768
	Exposure of Sensitive System Information to an Unauthorized Control Sphere SNYK-JS-NEXT-14400644	678

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Deserialization of Untrusted Data

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Review	Updated (UTC)
onchainkit-miniapp-manifest-generator	Skipped		Dec 13, 2025 8:27pm

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[gemini-code-assist]

Summary of Changes

Hello @Dargon789, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request, automatically generated by Snyk, aims to enhance the security posture of the project by updating the next dependency. The primary goal is to resolve two critical vulnerabilities, ensuring a more secure and stable foundation for the application by moving to a patched version of the framework.

Highlights

• Dependency Upgrade: The next dependency has been upgraded from version 15.3.3 to 15.3.8 in the packages/create-onchain/templates/next/package.json file.
• Security Fixes: This upgrade addresses two identified vulnerabilities: a high-severity 'Deserialization of Untrusted Data' (SNYK-JS-NEXT-14400636) and a medium-severity 'Exposure of Sensitive System Information to an Unauthorized Control Sphere' (SNYK-JS-NEXT-14400644).

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

packages/create-onchain/templates/next/package.json

Name	Version	Vulnerability	Severity
next	15.3.8	Next.js Improper Middleware Redirect Handling Leads to SSRF	moderate
		Next.js Content Injection Vulnerability for Image Optimization	moderate
		Next.js Affected by Cache Key Confusion for Image Optimization API Routes	moderate

OpenSSF Scorecard

Package	Version	Score	Details
npm/next	15.3.8	🟢 5.2	Details Check Score Reason Code-Review 🟢 7 Found 23/30 approved changesets -- score normalized to 7 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Maintained 🟢 10 30 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10 License 🟢 10 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Security-Policy 🟢 10 security policy file detected Signed-Releases ⚠️ -1 no releases found Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging 🟢 10 packaging workflow detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts ⚠️ 0 binaries present in source code SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing 🟢 10 project is fuzzed Vulnerabilities ⚠️ 0 250 existing vulnerabilities detected

Scanned Files

• packages/create-onchain/templates/next/package.json

[gemini-code-assist]

Code Review

This pull request, automatically generated by Snyk, upgrades the next package from 15.3.3 to 15.3.8 in the next template to resolve two security vulnerabilities. The update is correct and necessary.

My review includes one suggestion for improvement:

• In packages/create-onchain/templates/next/package.json, I've recommended using a caret (^) for the next dependency version. This aligns with the versioning strategy used in other templates within this repository and will help in automatically receiving future non-breaking security patches and bug fixes.

Additionally, please consider the following points for a more complete update:

• The eslint-config-next package in packages/create-onchain/templates/next/package.json is still at version 15.3.3. It's good practice to keep eslint-config-next aligned with the next version.
• I've noticed that other templates (minikit-basic, minikit-snake) and the minikit-example are still using the vulnerable version of next (^15.3.3). It would be beneficial to update the next dependency in those package.json files as well to ensure all templates are secure.